Exam CISM topic 1 question 914 discussion

Per GPT4o, it is C. "The business owner is responsible for the processes and outcomes within their area of the organization. Since the failure of a privileged access control can significantly impact business operations, data integrity, and security, it is essential that the business owner, who has the authority and accountability for the affected area, owns the associated risk. " When you ask it questions, make sure to say "use CISM guidelines" for a more accurate answer.

B- ISM does not own any risk.

Tough one but B.

These questions are always hard for me when accountable is not a word in the question. Hate to have to do this, but ISACA heavily states that the Business owner is always accountable for any risks . Since this question involves failure I am going to correlate own=accountable making the best answer C. I could be wrong, but here is my explanation of why I am going with C.

Its PAM

The most appropriate person to own the risk associated with the failure of a privileged access control is the B. Information security manager. The information security manager is responsible for implementing and maintaining controls related to access management and security. They are specifically trained and experienced in understanding and mitigating the risks associated with privileged access control. They have the knowledge and expertise to monitor and manage the systems, processes, and policies related to privileged access, ensuring that the appropriate measures are in place to protect sensitive information and prevent unauthorized access.

C. Business owner